Link Preview Js
Monthly
DNS rebinding in link-preview-js prior to 4.0.4 allows unauthenticated remote attackers to bypass the library's built-in SSRF protections and reach internal HTTP resources from the server hosting the preview service. The resolveDNSHost callback resolves a hostname once for validation but passes the original hostname back to the fetch layer, creating a time-of-check/time-of-use window that an attacker-controlled DNS server can exploit by returning a legitimate public IP during validation and an internal or loopback address on subsequent resolution. Vendor-released patch 4.0.4 is available; no public exploit identified at time of analysis, though the full fix is publicly documented in GitHub PR #181 and the GHSA-cpjf-6666-r8fx advisory.
The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
DNS rebinding in link-preview-js prior to 4.0.4 allows unauthenticated remote attackers to bypass the library's built-in SSRF protections and reach internal HTTP resources from the server hosting the preview service. The resolveDNSHost callback resolves a hostname once for validation but passes the original hostname back to the fetch layer, creating a time-of-check/time-of-use window that an attacker-controlled DNS server can exploit by returning a legitimate public IP during validation and an internal or loopback address on subsequent resolution. Vendor-released patch 4.0.4 is available; no public exploit identified at time of analysis, though the full fix is publicly documented in GitHub PR #181 and the GHSA-cpjf-6666-r8fx advisory.
The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.